Adrian ntop is CPU bound that means that even if you accelerate packet capture, ntop performance will not increase much. Please use nprobe are preprocessor of packets that are converted to flows and analyzed by ntop
Regards Luca On Jan 1, 2011, at 6:48 PM, Adrian Rapa wrote: > hi, > i am trying to do a ntop pfring setup. > I compiled pf_ring, e1000e and libpcap drivers from svn. > I compiled ntop with ./configure --with-rrd-home=/opt/rrdtool-1.4.5/ > --with-pcap-root=/kit/pf_ring/PF_RING/userland/libpcap-1.0.0-ring/ > LIBS="-lpcap -lpfring -lpthread" > I have eth1 which is a port mirror with about 700Mb of trafic RX+tx. > > If i start ntop -i eth1 i have a lot of packet loss. If i use top, i see that > a single cpu is used to capture packets. > As i know pf_ring should increase the packet capture rate, but it is acting > as normal linux pcap. > > is it normal for ntop to use a single cpu, or can i do somenthing to use all > 8 CPU? > > > -- > Cu respect, > Adrian Rapa > Millennium IT > > tel.: 0372-168.638 > fax.: 021-569.79.99 > e-mail: [email protected] > web: www.mitnet.ro > > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop --- "Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it. - Brian W. Kernighan _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
